T09 · Insecure Skill Coding Practices
Error
- Location
tools/skill_writer.py:755- Finding
Shell Command Injection Through Generated Runtime Instructions
- Content
View full analysis
\" --data-root ../../../.dreamlover-data`.\n" f"5. If `memory_prepare.py` returns `should_read: true`, use the returned `memory_context`.\n" f"6. Reply directly in character. Do not mention memory gates, routers, scripts, or checks.\n" f"7. If `memory_prepare.py` returns `should_write_after_reply: true`, silently call `python3 runtime/memory_commit.py --character-slug {slug} --user-message \"\" --assistant-message \"\" --data-root ../../../.dreamlover-data` after the reply.\n" ``` ### Technical Analysis The generated child `SKILL.md` instructs an Agent to place the latest user message and final assistant reply directly into a textual shell command. These values are enclosed only in double quotes and are not escaped or transferred through a non-shell data channel. Double quotes are not a safe boundary for attacker-controlled shell arguments. A malicious value containing a closing quote can terminate the intended argument and append shell operators. Depending on the command runner, command substitution syntax such as `$(...)` or backticks may also execute while still inside double quotes. Both interpolation points are unsafe: 1. `memory_prepare.py` receives attacker-controlled user content. 2. `memory_commit.py` receives both attacker-controlled user content and potentially attacker-influenced model output. The Python memory scripts themselves use `argparse` and do not invoke subprocesses. The vulnerability arises from the generated instructions causing an Age ...[truncated 1609 chars]- Remediation
View remediation